**** UPDATE **** This add-on functionality has been replaced by the following: * Data collection is now in the Splunk Add-on for Microsoft Security - https://splunkbase.splunk.com/app/6207/ * Dashboards are now in the Microsoft 365 Add-on for Splunk - https://splunkbase.splunk.com/app/3786/ The Microsoft 365 Defender Add-on for Splunk collects incidents and related information from Microsoft 365 Defender and/or alerts from Microsoft Defender for Endpoint. Microsoft 365 Defender Incidents * Incident (impossible travel, activity from Tor IP, suspicious inbox forwarding, successful logon using potentially stolen credentials, etc.) * Assignee * Classification * Severity * Status * Alerts associated with the Incident Microsoft Defender for Endpoint Alerts * Categories (Malware, Initial Access, Execution, etc.) * Detection source * Evidence * Computer name * Related user * Severity * Status